GRC Consultant – Cyber Lead (Non-OS Vulnerability Management)

About the role

We are looking for an experienced GRC Consultant – Cyber Lead to shape and govern non‑OS vulnerability management across enterprise applications and platforms. The role will drive risk oversight, exception handling, and treatment strategies while aligning with enterprise security standards.

Key responsibilities

• Define and implement non‑OS vulnerability management frameworks, policies, and standards.
• Establish governance forums, escalation paths, and decision‑making processes to ensure regulatory and audit compliance.
• Manage remediation exceptions, risk acceptance lifecycle, and validate compensating controls.
• Perform risk assessments for unremediated vulnerabilities and support risk‑based decision‑making.
• Lead tooling strategy, evaluate solutions (e.g., Qualys, Tenable, Snyk) and drive automation initiatives.
• Oversee remediation outcomes from pen‑tests, audits and promote secure‑by‑design and DevSecOps practices.
• Collaborate with Cyber, Application, Infrastructure and Operations teams, providing risk insights to senior leadership.

Required profile

• 8‑12+ years of experience in GRC, cyber risk, and vulnerability management.
• Hands‑on experience with application/platform (non‑OS) vulnerabilities.
• Strong knowledge of ISO 27001, NIST, CIS frameworks.
• Bachelor’s degree in IT, Cybersecurity or related field.
• Relevant certifications such as CISSP, CISM, CRISC, ISO 27001 Lead Implementer, FAIR (preferred).
• Excellent stakeholder engagement and communication skills.

Required skills

• Qualys, Tenable, Snyk (or similar vulnerability scanning tools).
• ISO 27001, NIST, CIS framework implementation.
• GRC processes, risk assessment and exception management.
• Vulnerability management and remediation planning.
• DevSecOps and SDLC security practices.